What is GHSA-vhf9-px93-5p48?

GHSA-vhf9-px93-5p48 is a security advisory published by GitHub Security Advisories with Medium severity. ToolJet before v3.16.208 contains an authorization bypass vulnerability in TooljetDB controller...

Which CVE IDs does GHSA-vhf9-px93-5p48 cover?

GHSA-vhf9-px93-5p48 covers the following CVE IDs: CVE-2026-82875. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-vhf9-px93-5p48?

GHSA-vhf9-px93-5p48 has a CVSS v3 base score of 5.5, published by GitHub Security Advisories.

GHSA-vhf9-px93-5p48MediumCVSS 5.5

ToolJet before v3.16.208 contains an authorization bypass vulnerability in TooljetDB controller...

Vendor

GitHub Security Advisories

Published

August 31, 2026

Last Modified

August 31, 2026

🔗 CVE IDs covered (1)

CVE-2026-82875 →

📋 Description

ToolJet before v3.16.208 contains an authorization bypass vulnerability in TooljetDB controller endpoints that accept organizationId from URL path without verifying it matches the authenticated user's workspace. Authenticated users can enumerate, create, rename, and delete TooljetDB tables in any other workspace by manipulating the organizationId parameter in requests.

🔗 References (4)

https://github.com/ToolJet/ToolJet/security/advisories/GHSA-cx42-x23w-vhvf
https://nvd.nist.gov/vuln/detail/CVE-2026-82875
https://www.vulncheck.com/advisories/tooljet-before-3.16.208-authorization-bypass-via-organizationid
https://github.com/advisories/GHSA-vhf9-px93-5p48